fix(security): fail closed on ambiguous dependency-review HTTP responses

[seonghobae]

Current integration receipt — 2026-09-08

• Exact owner head: 4ccb21d8ace608f28d11d72589e5deb78add3a33.
• Current protected source/base: main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db.
• Ordinary two-parent adoption: predecessor 0bb8f7c06cb2ce291101e7014afe90bef0fe40c4 plus protected main; exact tree bb57a09a8677536221b016cc3339cf258bcbb1de.
• Delta remains limited to the six canonical Dependency Review owner paths. Exact-tree local GREEN: focused 20 passed, full 3001 passed · 1 skipped · 21 subtests, diff check PASS.
• Fresh hosted exact-head materialization is 12 queued · 1 skipped; no queued or skipped result is counted as a security verdict.
• Exact-head approval is absent and unresolved review threads are zero. Keep Draft until every required/security/review gate is terminal, a qualifying current-head review is clean, and protected admission is ordinary.
• Dependency Review remains independently fail-closed: protected-main integration must be followed by an authenticated HTTP 200 compare and an actually executed dependency verdict before any consumer gate can be accepted.

Security owner outcome

This Draft is the canonical ContextualWisdomLab/.github owner lane for the Dependency Review admission boundary. It now consolidates the valid security deltas from protected #1724 and predecessor diagnostic #1643 without weakening the pinned Dependency Review action or any sibling scanner.

Three owner defects are repaired together:

1. pull-request HTTP 403/404 and every other non-200 compare result previously could be normalized to an unavailable/successful state in the reusable workflow; only HTTP 200 may now authorize the action;
2. thin reusable-workflow callers had omitted the least-privilege contents: read + pull-requests: read permission envelope that a called workflow cannot elevate itself;
3. the compare preflight trusted repository/base/head strings before transport; both the reusable workflow and bundled Security Scan now require exact immutable base/head object IDs and one legal non-dot owner/name repository identity before curl.

Test-first and carryover lineage

The original #1725 RED/GREEN lineage remains intact for non-200 fail-closed behavior and caller permissions. Current successor commits add #1643's still-valid immutable-identity requirement test-first:

• 3736634f95bf132bbbe208ffc80103863fe3a7c1 adds executable reusable-workflow regressions that require named/malformed revisions and malformed/dot-segment repository identities to fail before curl, while legal ContextualWisdomLab/.github reaches exactly one token-authenticated compare;
• b1e6263d9d9626b6cfd2046ce9147ab67867beec adds the corresponding reusable-workflow production validation;
• 8b86c0d2c6b0186538db1ed263f7cb9d222f3ca1 carries fix(security): validate immutable dependency-review identity on current main #1643's conflict-free bundled Security Scan identity preflight onto the current owner tree without force-push or destructive rebase;
• ae128374a2e38e60ada8bf5e89a9c7a4137f864f records the decisive A/B evidence and unified security invariants in canonical doctoring;
• 58a0b4c8ecc3073a64bd91457101229a21f020d4 adds a dedicated bundled-scan regression so the carried validation cannot silently disappear.

The temporary #1643 canary itself is deliberately not part of this publishable successor.

Decisive A/B evidence from #1643

Exact-head canary run 33589436750, job 100120235906, checked out a6a2759640e6aa1d1e1219e1cd7aacdeffef32c0 and compared exact base bb14b014eee31e6abdb5d2fffbb805aa29420eac to that head for ContextualWisdomLab/.github.

• anonymous request: HTTP 404, curl exit 0;
• job-token request with contents: read + pull-requests: read: HTTP 200, curl exit 0.

Therefore an anonymous response is not an availability authority. The least-privilege job token is the supported comparison boundary, and non-200 authenticated results remain fail-closed.

Current protected-main relationship — 2026-09-07

Protected source/base is main@c9052e607e5f3cc76e73207e7786b21500721b79; exact owner head is 0bb8f7c06cb2ce291101e7014afe90bef0fe40c4. The direct ordinary adoption records predecessor c2e8ab0e535245f8f53801ad6a11e107fe492341 and protected main as its two parents. The exact tree differs from main in only the six owner paths listed above. Reverse PR #1995 is closed and no longer participates in acceptance.

Consumer evidence and release boundary

Before caller permission repair, immutable reusable-workflow consumers such as ContextualWisdomLab/newsdom-api#784@1623977e6c37c78cb1a94a7a48c48f6d02cac86c (33622976911) and ContextualWisdomLab/mightyETL#330@65efdf7b4064df5b9811c0403defb707e6efbc02 (33623035969) terminated startup_failure with zero jobs. After explicit caller permissions, fresh exact heads materialized Dependency Review runs in newsdom-api, mightyETL, scopeweave and Argos.

After this PR reaches protected main through ordinary protection, consumers must pin the reusable workflow to that immutable protected-main SHA. No caller returns to @main, a PR head, or another mutable owner ref.

Exact-head gate

All predecessor check/review evidence is invalidated. The authoritative current-head materialization is the live tally in the receipt above; exact-head approval remains absent, and nonterminal/failed gates are not transferable. Keep Draft and ADR-0025 Proposed until this unchanged successor has terminal passing required checks, substantive-clean current reviews/threads, current base/mergeability, and ordinary protected admission.

Refs #810, #1150, #1643, #1724, #1728, #1731, #1734.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fleet handoff — a second migration defect is now live-evidenced and belongs in the central consolidation contract/doctoring before #1725 leaves Draft.

RCA: #1724's thin-caller replacements removed each caller workflow's permission envelope. A reusable workflow cannot elevate GITHUB_TOKEN permissions passed by its caller; the central workflow requests contents: read + pull-requests: read. On repositories whose default token does not already include that scope, the call fails before job creation. This is consistent with GitHub's reusable-workflow contract that permissions may only be maintained or downgraded across the call chain.

Exact RED evidence after immutable pinning (so mutable-ref resolution is no longer confounded):

• newsdom-api fix(coverage): gate PyO3 test deferral on exact-head native peer checks #784 1623977e6c37c78cb1a94a7a48c48f6d02cac86c: Dependency Review run 33622976911 -> startup_failure, zero jobs; referenced workflow resolved exactly to .github@0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03.
• mightyETL chore(deps): bump typing-extensions from 4.15.0 to 4.16.0 #330 65efdf7b4064df5b9811c0403defb707e6efbc02: run 33623035969 -> startup_failure, zero jobs.
• Original caller workflows prove the permissions were part of the pre-migration contract: scopeweave and newsdom-api had contents: read + pull-requests: read; Argos had the same; mightyETL had contents: read, which is insufficient once the centralized workflow itself also requires pull-requests: read.

Consumer GREEN repair is now applied without touching this owner branch: explicitly retain permissions: {contents: read, pull-requests: read} in the thin callers. Fresh exact heads now materialize instead of immediate zero-job failure: newsdom-api 9a798d5ac7b9b295a1accb2327fc76611352290f run 33623818000 queued; mightyETL 4576f863ede9fca0673d6cce5ae8a4093246f5ab run 33623854807 queued; scopeweave db8b8ed6d36a6dc6cc1d07255a7a9a86bc88bf4f run 33623761776 queued; Argos #557 ee4c5dd326977407435b0f2425fdecebc34a810f run 33623867278 pending.

Owner-path acceptance: extend #1725's central contract/ADR/doctoring/example caller so every reusable Dependency Review caller is required to pass at least contents: read and pull-requests: read; preserve the existing 403/404 fail-closed RED/GREEN; then merge normally and publish the resulting protected-main exact SHA for all four consumers to pin. No caller should return to @main.

[seonghobae]

Fresh owner-path re-read confirms the permission handoff has advanced correctly to an explicit RED at ee0f1ce544965772775b590050e40476df4ea8f6 (test(security): require caller permission envelope). The new contract requires the reusable workflow's documented thin caller to contain permissions: contents: read and pull-requests: read, while the workflow source at this exact head still shows concurrency immediately after on: and therefore does not yet satisfy that test. Keep this as RED rather than weakening the assertion.

Next owner GREEN should minimally update the canonical example/doctoring contract to include the two caller read permissions, preserve the existing non-200 fail-closed production repair, adopt protected main@8eaa65005005ac1e67e21f18f8627529d0f41f5c non-destructively, and reacquire exact-head gates before normal merge. Once that fixed protected merge SHA exists, the four consumer PRs can replace their temporary 0bcd22... pins with that immutable fixed SHA and rerun their real gates.

[seonghobae]

Fresh-base owner handoff for exact head 403ca1c4de8b3e477b5a9b1c102188278286b2c8 (read-only; no source/ref/PR-state mutation): protected ContextualWisdomLab/.github/main is now 63bf49835da44aa8257eb76a92368e6485ae6e94 via #1728, while this Draft still records base b4eec000d21084accb736d289eb64cfd78e7a91a and is currently non-mergeable. Preserve the HTTP-non-200 fail-closed and least-privilege caller-permission RED/GREEN deltas; non-force reconcile with the live protected base, then re-run focused tests and every exact-current-head required/security/provenance check. Do not transfer the prior 403ca1c4… evidence across the new integration head. Consumers must continue to wait for the resulting protected-main immutable SHA and then pin that exact SHA; no @main, PR-head, skipped/cancelled/queued, or predecessor evidence is release authority.

[seonghobae]

Fresh Naruon reproduction confirms this PR's permission-envelope RCA on a fifth consumer. ContextualWisdomLab/naruon#1539@6e7a8d8a947fec1ffdfff15f165b3a171ec2e03e pins reusable Dependency Review at protected .github@5f8e5b2a79e709c4ab1a4179a605d34c458b13a1; run 33630975578 resolves that referenced workflow but ends startup_failure with zero jobs. The Naruon thin caller currently omits caller-side permissions, matching the already-proven newsdom-api/mightyETL failure class in this PR. I am routing the consumer repair to #1539 without changing this central branch. GREEN for Naruon should include a fresh immutable central pin plus caller contents: read / pull-requests: read, followed by a real dependency-review / dependency-review job on the unchanged repaired caller head.

[seonghobae]

Current-main ancestry reconciliation rationale before write: protected main advanced to 78271917b526469c559fa75cb5ee39426e5494d1 after this Draft lane's prior reconciliation. Fresh compare is ahead_by=8 / behind_by=4 with merge base 63bf49835da44aa8257eb76a92368e6485ae6e94, but the effective tip-to-tip content delta remains exactly the four owner paths already named by this PR: reusable Dependency Review workflow, Proposed ADR-0025, doctoring, and executable contract test. The branch's latest commit 2595e246e8f4aba89fd1bbf0fe4c6980d0ee026c specifically reconciles the newer reusable-workflow contract (including comment_summary_in_pr and harden-runner tests), and every non-owner path is already content-identical to current protected main.

I will therefore preserve both histories without force/rebase by creating a two-parent reconciliation commit with the current branch tree unchanged, parents 2595e246e8f4aba89fd1bbf0fe4c6980d0ee026c and protected main@78271917b526469c559fa75cb5ee39426e5494d1, then move only this owner branch by fast-forward. This is ancestry repair only: no security behavior, ADR status, test expectation, or current protected-main intent is discarded.

[seonghobae]

Consumer owner-path acceptance from writable newsdom-api#784: current caller exact head b14586c218bb60e614136bef94e9fd8163f4d4b8 pins central workflow SHA 5f8e5b2a79e709c4ab1a4179a605d34c458b13a1. That protected-main commit still treats authenticated HTTP 403/404 compare responses as available=false and skips the hard gate; therefore it is not an acceptable security contract for the consumer. #1725 correctly owns the fail-closed repair. GREEN handoff requires: (1) unchanged #1725 protected-main descendant with non-200 fail-closed + caller permission/identity tests terminal-green, (2) ordinary protected merge, (3) canonical immutable owner release/tag for the reusable workflow (the repository currently exposes no Releases), and (4) newsdom-api caller/test constant bumped to that released owner identity followed by exact-head dependency-review / dependency-review terminal GREEN. Do not resolve by returning to @main, retaining 5f8e, or treating 403/404 as availability success.

[harbourviewcompany-create]

Evidence log — 2026-09-02

Exact current head: 58a0b4c8ecc3073a64bd91457101229a21f020d4.

• Current protected main: 8c085835fbf77de2321b72fa6b8dd946227e523e.
• GitHub compare: diverged, ahead_by=14, behind_by=7, merge base 78271917b526469c559fa75cb5ee39426e5494d1.
• GitHub currently reports the PR mechanically mergeable; there is no active merge conflict reported by the API. The branch is nevertheless behind current main, so current-head validation is not yet transferable.
• Exact-head required/security runs are queued/pending: OSV 33637850661, Secret Scan 33637849083, Security Scan 33637849313, CodeQL 33637849320, Scorecard 33637849319, SBOM 33637849219, SAST 33637849226, Python Security 33637849275.
• Security Scan currently has four queued jobs (osv-scan, dependency-review, trivy-fs, scorecard) in run 33637849313; no terminal result exists yet.
• Combined commit status currently exposes only CodeRabbit success; required GitHub Actions evidence is therefore non-terminal.
• Existing independent review evidence is stale: the recorded review was against predecessor head 403ca1c4..., not this exact head, so it is not treated as current approval.

Gate decision: HOLD. Do not mark ready or merge until the branch is reconciled against current protected main, focused QA passes on the resulting exact head, all applicable required/security checks are terminal and passing, and current qualifying review/thread requirements are satisfied.

[seonghobae]

Exact-head execution receipt: ordinary parents 0bb8f7c06cb2ce291101e7014afe90bef0fe40c4 + protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db, tree bb57a09a8677536221b016cc3339cf258bcbb1de. The protected CodeQL #2028 delta was adopted without entering this PR's six-path Dependency Review diff. Local GREEN: focused 20 passed; full 3001 passed, 1 skipped, 21 subtests; git diff --check PASS. Hosted exact-head gates remain nonterminal, so this is evidence only, not approval or merge authorization.

[seonghobae]

Fresh consumer evidence from ContextualWisdomLab/LineageWeave#983 confirms this canonical Dependency Review owner boundary remains live and fail-closed across the repair movement.

Exact consumer evidence:

• consumer protected base 83eba56149eb802cd63642c507c324c9976ec78e
• predecessor head 266303480fd5282f3a6682da895902c9dacdea81: Security Scan run 34222989425, dependency-review job 102051088248
• current head 2881ad6de8a92255b4028fd8f6670473e8746240: Security Scan run 34229414648, dependency-review job 102071541947
• both checkouts matched their exact heads
• both job tokens advertised contents: read, metadata: read, pull-requests: read
• both authenticated dependency-graph/compare/<base>...<head> preflights returned HTTP 403 with curl exit 0
• in both runs the workflow correctly failed closed and the pinned dependency-review action itself was skipped
• on the current head, Scorecard, OSV and Trivy all completed successfully, so this is not evidence of a LineageWeave source vulnerability or a generic scanner outage.

No LineageWeave caller-side skip/fallback or gate weakening was added. After #1725 reaches protected .github/main, acceptance still requires an immutable protected-main consumer pin plus a fresh consumer run that obtains authenticated HTTP 200 and executes the dependency verdict.

[seonghobae]

Fresh consumer evidence from ContextualWisdomLab/LineageWeave#983@8274f1a12e1f5c4ad7f31c91cba39cc79f277831 supports this canonical owner path. Security run 34271323036, dependency-review job 102213434249, checked out the exact head and verified the expected SHA successfully. The authenticated preflight then queried the dependency-graph compare for exact base 83eba56149eb802cd63642c507c324c9976ec78e → head 8274f1a12e1f5c4ad7f31c91cba39cc79f277831 on public ContextualWisdomLab/LineageWeave and received http_status=403, curl_exit=0; the job correctly failed closed before running Dependency Review. Scorecard and OSV on the same consumer head were GREEN. No LineageWeave-local scanner, receipt fabrication, or non-200 waiver was added. Please retain this as downstream RED evidence for the caller-permission/Dependency Review admission repair; consumer acceptance still requires this owner repair to reach protected .github/main, an immutable consumer pin where applicable, and a fresh exact consumer HTTP 200 + executed dependency verdict.

[seonghobae]

Second independent LineageWeave consumer confirms the same admission failure is systemic rather than specific to #983. On LineageWeave#929@fabdacd4c487be7feb8db02c32b79d4e7d89f581, Security run 34255176062, dependency-review job 102159059348, exact checkout verification passed. The token permissions reported Contents: read, Metadata: read, PullRequests: read; the authenticated dependency-graph compare for protected base 83eba56149eb802cd63642c507c324c9976ec78e → exact head fabdacd4c487be7feb8db02c32b79d4e7d89f581 on public ContextualWisdomLab/LineageWeave again returned http_status=403, curl_exit=0, so Dependency Review itself was correctly skipped and the job failed closed. OSV and Trivy on the same head were GREEN. This reproduces the #983 consumer RED on a distinct product branch and strengthens the caller-permission/admission RCA; keep the fix centralized here and require fresh downstream HTTP 200 + executed dependency verdict after protected owner delivery.

[seonghobae]

Fresh independent consumer evidence from ContextualWisdomLab/LineageWeave#983 reproduces the same authenticated admission boundary on exact head 28ed29508dc70be6e92a043c6d5a83cbea1e8271. Security run 34277210268, dependency-review job 102233148725, checks out that exact SHA successfully, verifies actual_sha == expected_sha, then calls the public repository dependency-graph compare for exact main@83eba56149eb802cd63642c507c324c9976ec78e...28ed2950... with the job token. The preflight reports http_status=403 curl_exit=0 and fails closed before actions/dependency-review-action executes. The job token permission envelope printed by Actions is contents: read, pull-requests: read, metadata: read.

This is not a LineageWeave source/scanner finding: the same exact head has SAST GREEN and OSV/Scorecard/Trivy lanes succeeding; no leaf substitute scanner or synthetic receipt was added. Treat this as another consumer acceptance case for #1725: after the owner repair reaches immutable protected main and the consumer pins it, the same exact authenticated compare must return HTTP 200 and Dependency Review must actually execute before the consumer gate can be GREEN.

[seonghobae]

Fresh consumer evidence from LineageWeave keeps this owner prerequisite live. ContextualWisdomLab/LineageWeave#983@17770e3dbc99201424d08017b7334348eff761ab, Security run 34282238497: exact scope detection is GREEN; Trivy, OSV and Scorecard are GREEN; Dependency Review job 102249740435 checks out the exact consumer head and fails only at Check dependency review support before the pinned action executes. This repeats the authenticated consumer admission failure on a newer exact head without a LineageWeave-local shim or scanner substitution. Treat it as consumer RED only; #1725 remains unmerged Draft owner work, so no owner GREEN/release or downstream acceptance is claimed.

[seonghobae]

Fresh LineageWeave consumer evidence from ContextualWisdomLab/LineageWeave#983@b69efde292a4bcf0c8ef78da31379965e9a34339:

Security Scan run 34303750908 materialized normally. Exact-head changed-scope, Trivy (102316331581), OSV (102316331665), and Scorecard lanes reached GREEN. Dependency Review job 102316331603 checked out and verified the exact b69 head, then failed specifically at Check dependency review support; the delegated Dependency review step was skipped. This reproduces the fail-closed admission problem on another exact immutable consumer head after ordinary workflow materialization. No LineageWeave-local substitute scanner, synthetic receipt, or gate waiver was introduced.

Keep this as consumer RED for the canonical owner repair/release path: after owner integration, the acceptance target remains an authenticated HTTP 200 compare plus an actually executed Dependency Review verdict on a consumer pinned to the immutable released owner revision.

[seonghobae]

Fresh LineageWeave consumer evidence on exact ContextualWisdomLab/LineageWeave#983@e2bcba49dd9b2baab129de9c3872d77f654dd16a reproduces the same owner-boundary admission failure after the leaf checkout is exact. Security Scan 34309004543, dependency-review job 102332004493: checkout exact dependency-review head = GREEN, Verify Dependency Review head checkout = GREEN, Check dependency review support = RED, and the actual Dependency review action is skipped. On the same exact head, Trivy job 102332004482 and Scorecard 102332004500 are GREEN; OSV also materialized independently. This remains fail-closed consumer evidence, not a request for a LineageWeave-local substitute or waiver. Please preserve the owner path through protected integration + immutable consumer pin + authenticated HTTP-200 compare + actually executed dependency verdict before counting the repair delivered.

[seonghobae]

LineageWeave consumer evidence update. Exact predecessor 69f7e6a3f74dd94d004268d3cc47b0e14f3e1d01 Security run 34326058042 reached exact checkout/verification and changed-scope successfully, then failed closed at Check dependency review support; the delegated Dependency Review action itself was skipped. OSV and Trivy completed successfully, so this is not evidence for a LineageWeave-local scanner defect and no leaf substitute/waiver was added. Current LineageWeave parent 031cb4fe51d43ac3d8f792fe8180ab858617d1bc has fresh Security run 34328980662 queued and will be treated as a new exact-head receipt rather than inheriting this predecessor verdict.

[seonghobae]

Fresh LineageWeave consumer receipt — ContextualWisdomLab/LineageWeave#983@92e6016eefb3376132a0bd7f35a23b63efad4a87, Security run 34333493168. Exact-head changed-scope detection is GREEN; OSV, Trivy filesystem scan, and Scorecard are GREEN. Dependency Review job 102409816104 checks out and verifies the exact head, then fails closed at Check dependency review support; the delegated Dependency review action is skipped and therefore no dependency verdict exists. This is current consumer evidence for the canonical support/admission boundary, not a LineageWeave vulnerability finding and not authority for a leaf-local substitute. Keep owner acceptance strict: authenticated support preflight + actually executed dependency verdict are both required before consumers can count the gate.

[seonghobae]

Fresh LineageWeave consumer evidence, exact PR #983 head b65d4301552f95de75eb51e085eb0f31dcdf5413: Security Scan run 34335655790 materialized normally. dependency-review job 102414895493 checked out and verified the exact head, then failed at Check dependency review support; the delegated Dependency review step was skipped. In the same exact run, changed-scope, Trivy and OSV completed GREEN. This reproduces the canonical admission defect after successful exact-head checkout, not a LineageWeave dependency finding. No leaf-local substitute/waiver was added. Please preserve this consumer case through protected owner promotion and require an actually executed Dependency Review verdict before consumer acceptance.

[seonghobae]

Fresh LineageWeave consumer evidence from #983 exact 87a462c621a45cf7b79c0e2dbb332011f54203ed (2026-09-09): Security Scan run 34338077607 checked out and verified the exact dependency-review head successfully, then job 102422456470 failed only at Check dependency review support; the actual Dependency review step was skipped. Changed-scope admission succeeded, OSV job 102422456474 succeeded, Trivy job 102422456577 succeeded, and no LineageWeave-local substitute/waiver was added. This reproduces the canonical support/admission boundary on a current consumer head; it is not evidence that the dependency verdict itself ran. Consumer will require a fresh authenticated HTTP-200 admission and executed Dependency Review after this owner repair reaches immutable protected truth.

[seonghobae]

Current LineageWeave consumer confirmation after the product head advanced normally: #983 exact 77e7710e18e51e70f1dca595142b24c2459c2a0d, Security run 34340137679. Exact dependency-review checkout and head verification succeeded; Check dependency review support failed; the actual Dependency review step was skipped. Changed-scope, OSV and Scorecard lanes are GREEN. This reproduces the same canonical admission boundary on the new exact consumer head after a real product test delta; no LineageWeave-local substitute, synthetic receipt or waiver was added. Acceptance still requires the owner repair to reach protected immutable truth followed by a fresh consumer run in which support admission succeeds and Dependency Review actually executes.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact PR #983 head 08164b7531832e58aa6193fab905df8af2cbc34a: Security run 34344807138, dependency-review job 102444088978. Exact head checkout and verification succeeded; Check dependency review support failed, so delegated Dependency review was skipped. Changed-scope, Trivy, OSV and Scorecard all completed GREEN. Treat this as canonical support/admission evidence; no LineageWeave-local substitute, synthetic status or waiver was added.

[seonghobae]

Fresh LineageWeave consumer evidence at exact consumer head 5398c939963ba27eeaa86cd55f5293c325db97bb: Security Scan run 34350221808, dependency-review job 102461426061. Exact dependency-review checkout and exact-head verification both pass; Check dependency review support then fails and the actual Dependency review step is skipped. Sibling changed-scope, OSV, Trivy, and Scorecard lanes are GREEN. This remains a fail-closed owner-path admission failure, not a LineageWeave vulnerability/scanner failure. No consumer-local substitute or waiver was added.

[seonghobae]

Fresh LineageWeave consumer evidence on exact PR #983 head 52b6b9306afd698c1ee27414cf9e3239b35c7455: Security Scan run 34353385899 checks out and verifies the exact Dependency Review head, then job 102471928899 fails at Check dependency review support; the actual Dependency review step is skipped. Trivy (102471928959), OSV (102471928836), and Scorecard (102471928895) are GREEN on the same run. This reproduces the delegated support-admission failure without a LineageWeave scanner finding. Please preserve fail-closed semantics and repair in the canonical reusable owner; consumer has not added a substitute/waiver.

[seonghobae]

Fresh LineageWeave consumer evidence on exact PR #983 head 3694f1d895d3366470e1bb32f749d05957c4bce2: Security Scan run 34359919082 reaches exact checkout/head verification, then dependency-review job 102493964514 fails at Check dependency review support; the actual Dependency Review step is skipped. Same-run Trivy, OSV and Scorecard complete GREEN. This reproduces the canonical admission defect without a leaf shim or waiver. Keep #1725 Draft/unreleased until protected integration; only a post-integration consumer run with an actually executed Dependency Review verdict can satisfy this boundary.

[seonghobae]

Fresh LineageWeave consumer RED on ContextualWisdomLab/LineageWeave#983 exact 5c34e522f0751841b54a2dbf60f99a3c637d6395: Security run 34366564498, dependency-review job 102516792503 checks out and verifies the exact head successfully, then fails at Check dependency review support; the delegated Dependency Review step is therefore skipped. Same-head Scorecard and OSV lanes are GREEN. This reproduces the owner-side support-admission defect after a new consumer head without a leaf shim or waiver. Keep #1725 fail-closed until its repair reaches protected integration and a released/exact owner SHA can be consumed; do not treat this mutable PR head as a consumer dependency.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact e262161078ca1e0aeec1568f25ada196984064cd (Security Scan run 34373412662): changed-scope and exact checkout/head verification completed, then dependency-review job 102540091614 failed at Check dependency review support; the actual Dependency review action was skipped. Sibling leaf-local scanners remain independently executable (OSV/Scorecard and the scan lanes are not replaced here). This reproduces the canonical admission failure on a current immutable consumer head. LineageWeave keeps the gate fail-closed and has not added a substitute status, waiver, mutable owner-head pin, or local bypass. Consumer acceptance remains pending an ordinary protected owner release plus an actually executed dependency verdict on the pinned released contract.

[seonghobae]

Fresh LineageWeave immutable-consumer reproduction on PR #983 exact head 557bc5d229e1e9261700f116ef7511067d65472c: Security Scan run 34376255288, dependency-review job 102549730849 checked out and verified the exact head successfully, then Check dependency review support failed and the delegated Dependency review step was skipped. Same run's OSV, Trivy, and Scorecard jobs are GREEN. This remains a canonical .github support/admission defect; no LineageWeave shim, waiver, synthetic receipt, or mutable owner-head dependency was added.

[seonghobae]

Fresh immutable consumer reproduction from ContextualWisdomLab/LineageWeave PR #983 exact head a2a7d55a6cd919429411d0d4fba56a6d3ff6c5cb: Security run 34385176859, dependency-review job 102579580608. Exact-head checkout and Verify Dependency Review head checkout succeed; Check dependency review support fails and the delegated Dependency review step is skipped. Same run OSV (102579580438), Trivy (102579580551), and Scorecard (102579580448) are GREEN. This remains canonical owner/control-plane admission evidence; no LineageWeave-local substitute, waiver, or mutable owner-head dependency is being introduced.

[seonghobae]

Fresh LineageWeave consumer reproduction on PR #983 exact head de233fe3848fd1244440ee1f161f2ae04bd916f0 (Security run 34391713084): changed-scope detection succeeds; dependency-review exact-head checkout and head verification both succeed; Check dependency review support fails and the delegated Dependency review step is skipped. Same-head Trivy filesystem, Scorecard, and OSV lanes are GREEN. This remains a canonical owner admission/control-plane repair; LineageWeave did not add a local substitute, waiver, or synthetic success receipt.

[seonghobae]

Fresh LineageWeave consumer reproduction after a test-only parent move:

• consumer: ContextualWisdomLab/LineageWeave#983@7552d5b8166f62753bb4af1ee09811ff74f3186b
• Security Scan run: 34397519399
• dependency-review job: 102620827406
• exact checkout + head verification: GREEN
• Check dependency review support: FAILURE
• delegated Dependency review: SKIPPED
• same run Scorecard 102620827355, Trivy 102620827478, and OSV 102620827566: GREEN

The consumer change adds only frontend/src/PostBody.structuredImageCoverage.test.tsx; it does not alter dependency metadata or the security workflow. This is another exact-head reproduction that admission remains fail-closed before an actual dependency verdict. No LineageWeave shim/waiver/synthetic receipt was added. Owner PR remains the repair boundary; protected publication + immutable consumer bump are still required before this can count as consumer acceptance.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact PR #983 head ce0259631582e9f8ce27eb9398f47e96942d0b34 (Security Scan run 34403951783): dependency-review job 102642342277 checks out and verifies the exact head successfully, then fails at Check dependency review support; the delegated Dependency review step is skipped. Same run: OSV 102642342181, Trivy 102642342228, and Scorecard 102642342248 are GREEN. This is still an owner-side fail-closed support/admission boundary; no LineageWeave waiver, substitute scanner, synthetic receipt, or mutable owner-head dependency was introduced. Please preserve exact-head semantics in the canonical repair.

[seonghobae]

LineageWeave current-head consumer reproduction for the central Dependency Review owner path.

Exact consumer: ContextualWisdomLab/LineageWeave#983@8c3f2048a7a5b914b370c2c071c5e1e77e0bcda3.
Security run 34409336292, dependency-review job 102661587337 reached exact checkout and head verification, then failed at Check dependency review support; the delegated Dependency review step was skipped. Same exact run has Trivy 102661587252, OSV 102661587306, and Scorecard 102661587347 GREEN, so this is not evidence for replacing those scanners or weakening the leaf gate.

Please keep the repair in canonical .github and require owner RED→GREEN→protected immutable integration before LineageWeave consumes it. LineageWeave will not add a substitute receipt/waiver, mutable owner-head dependency, or local gate bypass.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact PR #983 head 682c188d7e6a69509572405552881cbb1a6d633a: Security Scan run 34412045494, dependency-review job 102670473058. Exact checkout/head verification succeeds, then Check dependency review support fails closed and the delegated Dependency Review step is skipped. OSV 102670473081, Trivy 102670473049, and Scorecard 102670473233 are GREEN on the same head. LineageWeave has not added a substitute scanner, synthetic receipt/status, waiver, or mutable owner-head dependency. Please treat this as current consumer evidence for the canonical preflight/caller-permission repair; protected owner integration remains the prerequisite before consumer acceptance.

[seonghobae]

Fresh LineageWeave consumer evidence: exact head 45fc14629ffd4b27d6b969f01fabf8ffe0b2e991, Security run 34425499098, dependency-review job 102713109262. Exact dependency-review head checkout and head verification are GREEN; Check dependency review support fails closed, so the actual Dependency review step is skipped. This is the same owner-boundary failure, not a LineageWeave scanner finding. No leaf waiver/substitute receipt/shim added. Please preserve owner RED→GREEN→protected/released acceptance before consumer bump.

[seonghobae]

Fresh LineageWeave consumer reproduction for the central Dependency Review owner path.

• Consumer PR: fix: verify dashboard accessibility and enforce frontend coverage LineageWeave#983
• Exact head: 60d2f7800dc93b090a9f2659c9a195f8cdcf4320
• Security run: 34431425085
• dependency-review job: 102731140724
• Exact checkout/head verification: GREEN
• Check dependency review support: FAIL
• delegated Dependency review: SKIPPED
• OSV 102731140581, Trivy 102731140608, Scorecard 102731140651: GREEN

This is therefore still the central support/admission defect rather than a LineageWeave scanner finding. LineageWeave will not add a leaf waiver, substitute scanner, synthetic receipt/status, or mutable owner-head dependency. Please preserve fail-closed behavior, complete #1725 on the canonical owner path, publish the protected immutable owner SHA, then consumers can pin/bump to that released contract.